workdsh/.github/workflows/ci.yml

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
    tags: ['desktop-v*']
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  DSH_TELEMETRY_DISABLED: '1'

jobs:
  # Keep required checks conclusive for documentation-only changes. Workflow
  # path filters can leave required checks pending, so classify inside the run.
  changes:
    runs-on: ubuntu-latest
    outputs:
      product: ${{ steps.scope.outputs.product }}
      desktop: ${{ steps.scope.outputs.desktop }}
      web: ${{ steps.scope.outputs.web }}
    steps:
      - uses: actions/checkout@v6
        with:
          # GitHub's pull-request merge ref can retain the base branch's
          # submodule gitlink when the PR advances it to a descendant. Check
          # out the actual PR head so pinned submodules match upstream.json.
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - name: Classify changed paths
        id: scope
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          REF_TYPE: ${{ github.ref_type }}
          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          set -euo pipefail
          node --test scripts/bilingual-docs.test.mjs
          node scripts/verify-bilingual-docs.mjs
          if [[ "$EVENT_NAME" == "workflow_dispatch" || "$REF_TYPE" == "tag" ]]; then
            product=true
            desktop=true
            web=false
          elif [[ -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then
            product=true
            desktop=true
            web=true
          else
            git diff --check "$BASE_SHA" "$HEAD_SHA"
            product="$(git diff --name-only -z "$BASE_SHA" "$HEAD_SHA" | node scripts/classify-ci-changes.mjs)"
            changed_paths="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
            if [[ -n "$changed_paths" ]] && grep -q '^workdsh-web/' <<< "$changed_paths"; then web=true; else web=false; fi
            if [[ -n "$changed_paths" ]] && grep -qv '^workdsh-web/' <<< "$changed_paths"; then desktop=true; else desktop=false; fi
          fi
          echo "product=$product" >> "$GITHUB_OUTPUT"
          echo "desktop=$desktop" >> "$GITHUB_OUTPUT"
          echo "web=$web" >> "$GITHUB_OUTPUT"

  # Full product gate: build, typecheck, unit tests, and every headless smoke.
  # A documentation-only change already passed diff validation in `changes`.
  check:
    needs: changes
    runs-on: ubuntu-latest
    steps:
      - name: Documentation-only gate
        if: needs.changes.outputs.product == 'false'
        run: echo "Documentation-only change; product build and tests are not required."
      - uses: actions/checkout@v6
        if: needs.changes.outputs.product == 'true'
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        if: needs.changes.outputs.product == 'true'
        with:
          node-version: 22.23.2
      - if: needs.changes.outputs.product == 'true'
        run: corepack enable
      - name: Resolve Yarn cache folder
        if: needs.changes.outputs.product == 'true'
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        if: needs.changes.outputs.product == 'true'
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - if: needs.changes.outputs.product == 'true'
        run: yarn install --immutable
      - if: needs.changes.outputs.product == 'true'
        run: yarn check

  web-source-check:
    name: Web source checks (no installer)
    needs: changes
    if: needs.changes.outputs.web == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - working-directory: workdsh-web
        run: pnpm install --frozen-lockfile
      - working-directory: workdsh-web
        run: pnpm build
      - working-directory: workdsh-web
        run: pnpm typecheck
      - working-directory: workdsh-web
        run: pnpm check:versions
      - name: Install browser for Web integration tests
        working-directory: workdsh-web
        run: pnpm exec playwright install --with-deps chromium
      - working-directory: workdsh-web
        run: pnpm test:integration

  # Windows-only logic and unsigned NSIS build on a real Windows runner:
  # updates, window options, pwsh sandbox, volume diagnostics, and packaging.
  # The package gate runs once before packaging.
  desktop-windows:
    needs: changes
    if: needs.changes.outputs.desktop == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$env:GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - name: Package Windows through the single release script
        timeout-minutes: 60
        run: node scripts/package-desktop-release.mjs --source=${{ github.ref_type == 'tag' && 'published' || 'local' }}
      - name: Report unpacked Windows footprint
        run: node dsh-plugin-desktop/scripts/report-package-footprint.mjs dsh-plugin-desktop/dist/win-unpacked dsh-plugin-desktop/dist/windows-footprint.json
      - name: Upload Windows footprint report
        uses: actions/upload-artifact@v4
        with:
          name: desktop-footprint-windows-x64
          path: dsh-plugin-desktop/dist/windows-footprint.json
          if-no-files-found: error
          retention-days: 14
      - name: Upload Windows installer
        uses: actions/upload-artifact@v4
        with:
          name: dsh-plugin-desktop-windows-x64
          path: |
            dsh-plugin-desktop/dist/*.exe
            dsh-plugin-desktop/dist/*.blockmap
          if-no-files-found: error
          retention-days: 14

  # Per-architecture macOS packaging smoke on a real macOS runner: the signed
  # release is built manually on a credentialed machine, so an unsigned DMG
  # here catches Intel and Apple Silicon packaging regressions before a manual
  # release. No signing secrets ever reach this job.
  desktop-macos:
    needs: changes
    if: needs.changes.outputs.desktop == 'true'
    runs-on: macos-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        arch: [x64, arm64]
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - name: Resolve Yarn cache folder
        id: yarn-cache
        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
      - uses: actions/cache@v6
        with:
          path: ${{ steps.yarn-cache.outputs.dir }}
          key: yarn-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('yarn.lock', '.yarnrc.yml') }}
      - name: Package macOS through the single release script
        timeout-minutes: 55
        env:
          WORKDSH_MAC_ARCH: ${{ matrix.arch }}
        run: node scripts/package-desktop-release.mjs --source=${{ github.ref_type == 'tag' && 'published' || 'local' }}
      - name: Upload macOS architecture DMG
        uses: actions/upload-artifact@v4
        with:
          name: dsh-plugin-desktop-macos-${{ matrix.arch }}
          path: |
            dsh-plugin-desktop/dist/mac-smoke/${{ matrix.arch }}/*.dmg
            dsh-plugin-desktop/dist/mac-smoke/${{ matrix.arch }}/*.dmg.blockmap
          if-no-files-found: error
          retention-days: 14

  # Upstream toolchain smoke: the portable-shell scripts must resolve the
  # pinned submodule's own Yarn/pnpm release on Windows.
  upstream-command-windows:
    needs: changes
    if: needs.changes.outputs.desktop == 'true'
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
          submodules: recursive
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - run: corepack enable
      - run: yarn check:layout
      - run: yarn upstream:version

  publish-desktop-release:
    if: github.ref_type == 'tag' && startsWith(github.ref_name, 'desktop-v')
    needs: [check, desktop-windows, desktop-macos, upstream-command-windows]
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22.23.2
      - name: Require one DSH version before publication
        run: node scripts/verify-desktop-dsh-alignment.mjs
      - name: Require release tag to match Desktop package version
        env:
          TAG: ${{ github.ref_name }}
        run: |
          node -e "const version = require('./dsh-plugin-desktop/package.json').version; if (process.env.TAG !== 'desktop-v' + version) { throw new Error('Release tag does not match Desktop package version: ' + process.env.TAG + ' != desktop-v' + version) }"
      - name: Download desktop packages
        uses: actions/download-artifact@v5
        with:
          pattern: dsh-plugin-desktop-*
          path: staging
      - name: Prepare uniquely named release assets
        shell: bash
        run: |
          set -euo pipefail
          mkdir release-assets
          while IFS= read -r -d '' file; do
            artifact="$(basename "$(dirname "$file")")"
            name="$(basename "$file")"
            cp "$file" "release-assets/${artifact}--${name}"
          done < <(find staging -type f -print0)
          (cd release-assets && sha256sum -- * > SHA256SUMS)
      - name: Publish GitHub prerelease
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        shell: bash
        run: |
          VERSION="${TAG#desktop-v}"
          cat > release-notes.md <<'EOF'
          WorkDSH Desktop 将 WorkBuddy 风格的项目、资料、专家、技能和连接器工作台与 DeepSeek Harness 插件能力结合。

          - 技能页接入 SkillHub 目录，可查看技能图标、来源、版本与安装入口；本地技能仍可单独管理。
          - 现有插件页可直接发现 DSH 社区插件，并打开第三方 dsh-market 目录进行搜索和安装。
          - Desktop 使用锁定的官方 DSH 0.1.7-rc.2 Profile；内置 Node.js 和 Python，不额外打包浏览器。
          - 提供 Windows x64 安装包，以及 macOS Intel x64、Apple Silicon arm64 未签名 DMG。

          SkillHub 和 dsh-market 是独立第三方来源；目录内容并非全部预装或经 WorkDSH 审核。安装前请检查许可、依赖和版本兼容性。本次为 Alpha 预发布，升级前请备份本地配置和数据。所有文件的 SHA-256 见 `SHA256SUMS`。
          EOF
          gh release create "$TAG" release-assets/* \
            --repo "$GITHUB_REPOSITORY" \
            --title "WorkDSH Desktop ${VERSION}" \
            --notes-file release-notes.md \
            --latest